Automatically sign commits using GitHub API instead of GitPython and GPG (#44)

Author: RoseSecurity

src/config.py

@@ -16,7 +16,6 @@ def __init__(self,
                  go_getter_tool: str,
                  dry_run: bool,
                  affected_components_file: str = '',
-                 gpg_key_id: str = '',
                  pr_title_template: str = '',
                  pr_body_template: str = '',
                  pr_labels: str = 'component-update'):
@@ -31,7 +30,6 @@ def __init__(self,
         self.dry_run: bool = dry_run
         self.components_download_dir: str = io.create_tmp_dir()
         self.skip_component_repo_fetching: bool = False
-        self.gpg_key_id: str = gpg_key_id
         self.pr_title_template: str = pr_title_template
         self.pr_body_template: str = pr_body_template
         self.pr_labels: List[str] = utils.parse_comma_or_new_line_separated_list(pr_labels)

src/github_provider.py

@@ -82,21 +82,23 @@ def get_branches(self, repo_dir: str):
 
         return set(branches)
 
-    def create_branch_and_push_all_changes(self, repo_dir: str, branch_name: str, commit_message: str):
-        repo = git.repo.Repo(repo_dir)
+    def create_branch_and_push_all_changes(self, branch_name: str, commit_message: str):
+        base_branch = self.__repo.get_branch(self.__repo.default_branch)
+        base_tree = self.__repo.get_git_tree(base_branch.commit.sha)
 
-        new_branch = repo.create_head(branch_name)
+        self.__repo.create_git_ref(ref=f"refs/heads/{branch_name}", sha=base_branch.commit.sha)
 
-        repo.git.checkout(new_branch)
-        repo.git.add("-A")
+        new_tree = self.__repo.create_git_tree([], base_tree.sha)
+        commit = self.__repo.create_git_commit(
+            message=commit_message,
+            tree=new_tree.sha,
+            parents=[base_branch.commit.sha]
+        )
 
-        if self.__config.gpg_key_id:
-            repo.git.commit('-S', f'--gpg-sign={self.__config.gpg_key_id}', '-m', commit_message)
-        else:
-            repo.index.commit(commit_message)
+        self.__repo.update_git_ref(ref=f"heads/{branch_name}", sha=commit.sha)
 
         if not self.__config.dry_run:
-            repo.git.push("--set-upstream", "origin", branch_name)
+            logging.info(f"Changes pushed to branch {branch_name}")
 
     def branch_exists(self, branch_name: str):
         remote_branch_name = f'origin/{branch_name}'

src/main.py

@@ -69,11 +69,6 @@ def main(github_api_token: str, config: Config):
               show_default=True,
               default="affected_components.json",
               help="Path to output file that will contain list of affected components in json format")
-@click.option('--gpg-key-id',
-              required=False,
-              show_default=True,
-              default="",
-              help="GPG key ID to sign commits")
 @click.option('--pr-title-template',
               required=False,
               show_default=True,
@@ -101,7 +96,6 @@ def cli_main(github_api_token,
              log_level,
              dry_run,
              affected_components_file,
-             gpg_key_id,
              pr_title_template,
              pr_body_template,
              pr_labels):
@@ -119,7 +113,6 @@ def cli_main(github_api_token,
                     go_getter_tool,
                     dry_run,
                     affected_components_file,
-                    gpg_key_id,
                     pr_title_template,
                     pr_body_template,
                     pr_labels)